# Firmware Infos # Evaluation Kit CYW927035 FW_NAME = "CYW27035B1" # Device Infos DEVICE_NAME = 0x280CD0 # rm_deviceLocalName, FIXME has no longer a length byte prepended BD_ADDR = 0x280CA4 # rm_deviceBDAddr #Heap BLOC_HEAD = 0x200474 # g_dynamic_memory_GeneralUsePools BLOC_NG = True # Next Generation Bloc Buffer # Memory Sections # start, end, is_rom? is_ram? SECTIONS = [ MemorySection(0x00000000, 0x001fffff, True, False), # Internal ROM MemorySection(0x00200000, 0x0024ffff, False, True), # Internal Memory Cortex M3 MemorySection(0x00270000, 0x0027ffff, False, True), # Internal Memory Patchram Contents MemorySection(0x00280000, 0x00283fff, False, True), # ToRam MemorySection(0x00300000, 0x00307fff, False, True), # HW Regs Cortex M3 (readable) MemorySection(0x00310000, 0x00321fff, False, True), # HW Regs Cortex M3 (readable) MemorySection(0x00326000, 0x0032ffff, False, True), # HW Regs Cortex M3 (readable) MemorySection(0x00338000, 0x00367fff, False, True), # HW Regs Cortex M3 (readable) + Pka Top MemorySection(0x00370000, 0x0037ffff, False, True), # RTX FIFO MemorySection(0x00390000, 0x00397fff, False, True), # Power WD
# fitness for a particular purpose and noninfringement. In no event shall the # authors or copyright holders be liable for any claim, damages or other # liability, whether in an action of contract, tort or otherwise, arising from, # out of or in connection with the Software or the use or other dealings in the # Software. from fw import MemorySection # Firmware Infos # Samsung Galaxy S8 FW_NAME = "BCM4347B0" # Memory Sections # start, end, is_rom? is_ram? SECTIONS = [ MemorySection(0x00000000, 0x00100000, True, False), # Internal ROM MemorySection(0x00130000, 0x00150000, False, True), # Internal Memory Patchram Contents MemorySection(0x00200000, 0x0023ffff, False, True), # Internal Memory Cortex M3 ] # Patchram PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000 PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404 PATCHRAM_VALUE_TABLE_ADDRESS = 0x130000 PATCHRAM_NUMBER_OF_SLOTS = 256 PATCHRAM_ALIGNED = False # Heap BLOC_HEAD = 0x20067C # g_dynamic_memory_GeneralUsePools
# - The Software is provided "as is", without warranty of any kind, express or # implied, including but not limited to the warranties of merchantability, # fitness for a particular purpose and noninfringement. In no event shall the # authors or copyright holders be liable for any claim, damages or other # liability, whether in an action of contract, tort or otherwise, arising from, # out of or in connection with the Software or the use or other dealings in the # Software. from fw import MemorySection # Firmware Infos # Evaluation Kit CYW20706 FW_NAME = "CYW20706" # Memory Sections # start, end, is_rom? is_ram? SECTIONS = [ MemorySection(0x00000000, 0x000c7fff, True, False), # Internal ROM MemorySection(0x000d0000, 0x000dffff, False, True), MemorySection(0x00200000, 0x00247fff, False, True), # Internal Memory Cortex M3 ] # Patchram #PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000 #PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404 #PATCHRAM_VALUE_TABLE_ADDRESS = 0x0d0000 #PATCHRAM_NUMBER_OF_SLOTS = 256 PATCHRAM_ALIGNED = True # only seems to work 4-byte aligned here ...
# the Software without restriction, including without limitation the rights to # use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of # the Software, and to permit persons to whom the Software is furnished to do so, # subject to the following conditions: # - The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # - The Software is provided "as is", without warranty of any kind, express or # implied, including but not limited to the warranties of merchantability, # fitness for a particular purpose and noninfringement. In no event shall the # authors or copyright holders be liable for any claim, damages or other # liability, whether in an action of contract, tort or otherwise, arising from, # out of or in connection with the Software or the use or other dealings in the # Software. from fw import MemorySection # Firmware Infos FW_NAME = "BCM20702A1 (USB Bluetooth dongle)" # Device Infos #DEVICE_NAME = 0x280CD0 # rm_deviceLocalName, FIXME has no longer a length byte prepended #BD_ADDR = 0x280CA4 # rm_deviceBDAddr # Memory Sections # start, end, is_rom? is_ram? SECTIONS = [ MemorySection(0x00000000, 0x5ffff, True, False), # Internal ROM MemorySection(0x80000, 0x9bfff, False, True), # Internal RAM ] BLOC_HEAD = 0x3166c
# Copyright (c) 2019 Jiska Classen. (MIT License) # # Permission is hereby granted, free of charge, to any person obtaining a copy of # this software and associated documentation files (the "Software"), to deal in # the Software without restriction, including without limitation the rights to # use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of # the Software, and to permit persons to whom the Software is furnished to do so, # subject to the following conditions: # - The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # - The Software is provided "as is", without warranty of any kind, express or # implied, including but not limited to the warranties of merchantability, # fitness for a particular purpose and noninfringement. In no event shall the # authors or copyright holders be liable for any claim, damages or other # liability, whether in an action of contract, tort or otherwise, arising from, # out of or in connection with the Software or the use or other dealings in the # Software. from fw import MemorySection # Firmware Infos FW_NAME = "default (unknown firmware)" # Memory Sections # start, end, is_rom? is_ram? SECTIONS = [ MemorySection(0x0, 0x90000, True, False), MemorySection(0xd0000, 0xd8000, False, True), MemorySection(0x200000, 0x228000, False, True) ]
# Firmware Infos # Evaluation Kit CYW920719 FW_NAME = "CYW20739B1 (NOT iPhone X/XR!)" # TODO this is not the iPhone firmware, we need to add a switch in fw.py # Device Infos DEVICE_NAME = 0x280CD0 # rm_deviceLocalName, FIXME has no longer a length byte prepended BD_ADDR = 0x280CA4 # rm_deviceBDAddr #Heap BLOC_HEAD = 0x0200c7c # g_dynamic_memory_GeneralUsePools BLOC_NG = True # Next Generation Bloc Buffer # Memory Sections # start, end, is_rom? is_ram? SECTIONS = [ MemorySection(0x00000000, 0x001fffff, True, False), # Internal ROM MemorySection(0x00200000, 0x0024ffff, False, True), # Internal Memory Cortex M3 MemorySection(0x00270000, 0x0027ffff, False, True), # Internal Memory Patchram Contents MemorySection(0x00280000, 0x00283fff, False, True), # ToRam ] # Patchram PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000 PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404 PATCHRAM_VALUE_TABLE_ADDRESS = 0x270000 PATCHRAM_NUMBER_OF_SLOTS = 256 PATCHRAM_ALIGNED = False # only seems to work 4-byte aligned here ... # Assembler snippet for tracepoints
# out of or in connection with the Software or the use or other dealings in the # Software. from fw import MemorySection # Firmware Infos # This runs on an iPhone 7 FW_NAME = "BCM4355C0" # Device Infos DEVICE_NAME = 0x204c60 # Memory Sections # start, end, is_rom? is_ram? SECTIONS = [ MemorySection(0x0, 0x90000, True, False), MemorySection(0xd0000, 0xd8000, False, True), #MemorySection(0xe0000, 0x1f0000, True , False), MemorySection(0x200000, 0x228000, False, True), MemorySection(0x260000, 0x268000, True, False), #MemorySection(0x280000, 0x2a0000, True , False), MemorySection(0x318000, 0x320000, False, False), MemorySection(0x324000, 0x360000, False, False), MemorySection(0x362000, 0x362100, False, False), MemorySection(0x363000, 0x363100, False, False), MemorySection(0x600000, 0x600800, False, False), MemorySection(0x640000, 0x640800, False, False), MemorySection(0x650000, 0x650800, False, False), #MemorySection(0x680000, 0x800000, False, False) ]
# fitness for a particular purpose and noninfringement. In no event shall the # authors or copyright holders be liable for any claim, damages or other # liability, whether in an action of contract, tort or otherwise, arising from, # out of or in connection with the Software or the use or other dealings in the # Software. from fw import MemorySection # Firmware Infos # Evaluation Kit CYW920819 FW_NAME = "CYW20819" # Memory Sections # start, end, is_rom? is_ram? SECTIONS = [ MemorySection(0x00000000, 0x001fffff, True, False), # Internal ROM MemorySection(0x00200000, 0x0024ffff, False, True), # Internal Memory Cortex M3 MemorySection(0x00270000, 0x0027ffff, False, True), # Internal Memory Patchram Contents MemorySection(0x00310000, 0x00321fff, False, True), # HW Regs Cortex M3 (readable) ] # Patchram PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000 PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404 PATCHRAM_VALUE_TABLE_ADDRESS = 0x270000 PATCHRAM_NUMBER_OF_SLOTS = 256 PATCHRAM_ALIGNED = False # only seems to work 4-byte aligned here ...
# Software. from fw import MemorySection # Firmware Infos # This runs on Nexus 6P, Samsung Galaxy S6, Samsung Galaxy S6 edge FW_NAME = "BCM4358A3" # Device Infos DEVICE_NAME = 0x213994 # [type: 1byte] [len: 1byte] [name: len byte] #works BD_ADDR = 0x201C48 #works # Memory Sections # start, end, is_rom? is_ram? SECTIONS = [ MemorySection(0x0, 0x9ef00, True , False), MemorySection(0xd0000, 0xd8000, False, True ), # Patchram values with actual code / hooks #MemorySection(0xe0000, 0x1e0000, True , False), # all zero MemorySection(0x200000, 0x22a000, False, True ), MemorySection(0x260000, 0x268000, True , False), #MemorySection(0x280000, 0x2a0000, True , False), # all zero MemorySection(0x300000, 0x301000, False, False), MemorySection(0x310000, 0x318000, False, True ), # Patchram addresses MemorySection(0x318000, 0x322000, False, False), MemorySection(0x324000, 0x368000, False, False), MemorySection(0x600000, 0x600800, False, False), MemorySection(0x640000, 0x640800, False, False), MemorySection(0x650000, 0x650800, False, False), #MemorySection(0x680000, 0x800000, False, False) #MemorySection(0x770000, 0x78ffff, False, False), #TODO maybe more, but all zero ]
# fitness for a particular purpose and noninfringement. In no event shall the # authors or copyright holders be liable for any claim, damages or other # liability, whether in an action of contract, tort or otherwise, arising from, # out of or in connection with the Software or the use or other dealings in the # Software. from fw import MemorySection # Firmware Infos FW_NAME = "BCM20703A2 (MacBook Pro 2016)" # Symbols contained in: # ./WICED-Studio-6.2/20706-A2_Bluetooth/Wiced-BT/BLD_ROM/A_20703A2/20703.symdefs # ./WICED-Studio-6.2/20706-A2_Bluetooth/Wiced-BT/tier2/brcm/wiced_uart/bld/A_20703A2/20703_ram_ext.lst # Memory Sections # start, end, is_rom? is_ram? SECTIONS = [ MemorySection(0x0, 0xc7fff, True, False), #0x000c0a97 MemorySection(0xd0000, 0xe0000, False, False), #0x000dd78c MemorySection(0x200000, 0x240000, False, True), #0x00217a38 MemorySection(0x260000, 0x268fff, True, False), #0x0026841d MemorySection(0x318000, 0x320000, False, False), MemorySection(0x324000, 0x338000, False, False), MemorySection(0x362000, 0x362100, False, False), MemorySection(0x363000, 0x363100, False, False), MemorySection(0x600000, 0x600800, False, False), MemorySection(0x640000, 0x640800, False, False), MemorySection(0x650000, 0x650800, False, False) ]
# subject to the following conditions: # - The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # - The Software is provided "as is", without warranty of any kind, express or # implied, including but not limited to the warranties of merchantability, # fitness for a particular purpose and noninfringement. In no event shall the # authors or copyright holders be liable for any claim, damages or other # liability, whether in an action of contract, tort or otherwise, arising from, # out of or in connection with the Software or the use or other dealings in the # Software. from fw import MemorySection # Firmware Infos # iPhone 8/X/XR FW_NAME = "BCM4347B1" # Memory Sections # start, end, is_rom? is_ram? SECTIONS = [ MemorySection(0x00000000, 0x00103fff, True, False), # Internal ROM MemorySection(0x00130000, 0x0014ffff, False, True), # Internal Memory Patchram Contents MemorySection(0x00200000, 0x0024ffff, False, True), # Internal Memory Cortex M3 ] # Patchram PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000 PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404 PATCHRAM_VALUE_TABLE_ADDRESS = 0x130000 PATCHRAM_NUMBER_OF_SLOTS = 256 PATCHRAM_ALIGNED = False
# Copyright (c) 2019 Jiska Classen. (MIT License) # # Permission is hereby granted, free of charge, to any person obtaining a copy of # this software and associated documentation files (the "Software"), to deal in # the Software without restriction, including without limitation the rights to # use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of # the Software, and to permit persons to whom the Software is furnished to do so, # subject to the following conditions: # - The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # - The Software is provided "as is", without warranty of any kind, express or # implied, including but not limited to the warranties of merchantability, # fitness for a particular purpose and noninfringement. In no event shall the # authors or copyright holders be liable for any claim, damages or other # liability, whether in an action of contract, tort or otherwise, arising from, # out of or in connection with the Software or the use or other dealings in the # Software. from fw import MemorySection # Firmware Infos FW_NAME = "BCM2070B0 (MacBook Pro 2011)" # Build date: Jul 9 2008 # Memory Sections # start, end, is_rom? is_ram? SECTIONS = [ MemorySection(0x0, 0x58000, True, False), MemorySection(0x80000, 0x9b000, False, True), ]
# all copies or substantial portions of the Software. # - The Software is provided "as is", without warranty of any kind, express or # implied, including but not limited to the warranties of merchantability, # fitness for a particular purpose and noninfringement. In no event shall the # authors or copyright holders be liable for any claim, damages or other # liability, whether in an action of contract, tort or otherwise, arising from, # out of or in connection with the Software or the use or other dealings in the # Software. from fw import MemorySection # Firmware Infos # iPhone 6 FW_NAME = "BCM4345B0" # Memory Sections # start, end, is_rom? is_ram? SECTIONS = [ #MemorySection(0x00000000, 0x000c07ff, True, False), # Internal ROM MemorySection(0x000d0000, 0x000dffff, False, True), # Internal Memory Patchram Contents #MemorySection(0x00200400, 0x00201cff, False, True), # Internal Memory Cortex M3 ] # Patchram #PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000 #TODO needs to be aligned read #PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204 #PATCHRAM_VALUE_TABLE_ADDRESS = 0xd0000 #PATCHRAM_NUMBER_OF_SLOTS = 128 #PATCHRAM_ALIGNED = True # only seems to work 4-byte aligned here ...
# - The Software is provided "as is", without warranty of any kind, express or # implied, including but not limited to the warranties of merchantability, # fitness for a particular purpose and noninfringement. In no event shall the # authors or copyright holders be liable for any claim, damages or other # liability, whether in an action of contract, tort or otherwise, arising from, # out of or in connection with the Software or the use or other dealings in the # Software. from fw import MemorySection # Firmware Infos # iPhone 6 FW_NAME = "BCM4345B0" # Memory Sections # start, end, is_rom? is_ram? SECTIONS = [ MemorySection(0x00000000, 0x000c07ff, True, False), # Internal ROM MemorySection(0x000d0000, 0x000dffff, False, True), # Internal Memory Patchram Contents MemorySection(0x00200400, 0x00201cff, False, True), # Internal Memory Cortex M3 ] # Patchram #PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000 #TODO needs to be aligned read #PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310204 #PATCHRAM_VALUE_TABLE_ADDRESS = 0xd0000 #PATCHRAM_NUMBER_OF_SLOTS = 128 #PATCHRAM_ALIGNED = True # only seems to work 4-byte aligned here ...
# Software. from fw import MemorySection # Firmware Infos # Samsung S10/S10e/S10+ FW_NAME = "BCM4375B1" # Device Infos DEVICE_NAME = 0x207f2a BD_ADDR = 0x2026e2 # Memory Sections # start, end, is_rom? is_ram? SECTIONS = [ MemorySection(0x00000000, 0x0013ffff, True, False), # Internal ROM MemorySection(0x00160000, 0x0017ffff, False, True), # Patches MemorySection(0x00200000, 0x00288000, False, True), # Internal Memory Cortex M3 MemorySection(0x00300000, 0x0037ffff, False, True), ] # Patchram PATCHRAM_TARGET_TABLE_ADDRESS = 0x310000 PATCHRAM_ENABLED_BITMAP_ADDRESS = 0x310404 PATCHRAM_VALUE_TABLE_ADDRESS = 0x160000 PATCHRAM_NUMBER_OF_SLOTS = 256 PATCHRAM_ALIGNED = False BLOC_HEAD = 0x20075c BLOC_NG = True